Vehicular Ad Hoc Networks (VANETs) play a critical role in Intelligent Transportation Systems (ITS) by enabling real-time vehicle communication for safety and traffic management. However, the open and decentralized nature of VANETs makes them vulnerable to False Information Attacks (FIA), where malicious vehicles disseminate fabricated data such as fake congestion alerts or incorrect speed information. This paper presents a lightweight and infrastructure-free framework for detecting FIA using an unsupervised machine learning approach based on the Isolation Forest algorithm. Unlike existing methods that require roadside units (RSUs), labeled datasets, or computationally intensive network simulators, the proposed framework operates using a small set of behavioral features extracted from vehicle beacon messages. The system is implemented entirely in Python and evaluated on a synthetically generated dataset designed to emulate realistic VANET conditions. Experimental results demonstrate an accuracy of 94.2%, precision of 86.1%, recall of 77.5%, and an F 1 -score of 81.6%. The results show that the proposed framework achieves competitive detection performance while maintaining low computational overhead, making it suitable for deployment on resource-constrained onboard units (OBUs) in real-world vehicular networks.
Hassan Mistareehi, Shafika Showkat Moni, A. Aboualy et al.· International Conference on...· 0 citations
Deploying effective intrusion detection systems (IDS) on resource-constrained embedded hardware demands models that maximise threat recall under severe class imbalance and tight computational budgets. This paper presents a systematic, multi-cycle experimental study comparing neural network architectures—multi-layer perceptrons (MLPs) of varying depth, a long short-term memory (LSTM) network, and classical machine-learning baselines (Random Forest, XGBoost)—for binary classification of network traffic in an embedded testbed environment. Three findings distinguish our work. First, we show that temporal holdout splitting consistently outperforms k-fold cross-validation for network traffic data because random fold assignment violates the temporal autocorrelation structure of network flows, inflating k-fold recall estimates by 4–7 percentage points. Second, we demonstrate that removing four machine-specific identifiers (source/destination IP addresses and port numbers) improves recall by approximately 20 percentage points—a larger gain than any architectural change evaluated. Third, despite its theoretical suitability for sequential data, the LSTM underperforms the optimised MLP ($26.7\%$ vs. $50.7\%$ recall) on this small, imbalanced dataset, while classical tree-based methods achieve competitive recall with substantially lower inference cost. These results provide concrete, empirically grounded guidelines for IDS practitioners targeting embedded deployment, and highlight systematic evaluation pitfalls that are widespread in the network-security literature.
Hassan Mistareehi, Rizwan Syed, Ezana Fekadu et al.· International Conference on...· 0 citations